fix(deps): update module github.com/coreos/go-oidc/v3 to v3.21.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/coreos/go-oidc/v3	v3.20.0 → v3.21.0

---

Release Notes

coreos/go-oidc (github.com/coreos/go-oidc/v3)

v3.21.0

Compare Source

What's Changed

• oidc: ignore JWKs with unsupported key types rather than failing by @​nicoske in #​499

New Contributors

• @​nicoske made their first contribution in #​499

Full Changelog: coreos/go-oidc@v3.20.0...v3.21.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: github.com/coreos/go-oidc/v3
• Version: v3.20.0 → v3.21.0
• Type: minor (within v3.x series)

Release Changes

• oidc: ignore JWKs with unsupported key types rather than failing (PR #499 by @nicoske)

Breaking Changes

None affecting our usage. This is a behavioral change that makes the library more robust.

Code Changes Required

None. The application uses go-oidc's standard APIs:

• oidc.NewProvider() - internal/auth/oidc.go:101
• provider.Verifier() - internal/auth/oidc.go:119
• verifier.Verify() - internal/auth/oidc.go:188

Security Impact

The change to ignore unsupported JWK key types instead of failing is potentially concerning from a security perspective:

• Benefit: Application won't break if OIDC provider adds new key types
• Risk: If a malicious actor can inject unsupported key types into the JWKS endpoint, those keys would be silently ignored, potentially masking a security issue
• Mitigation: This risk is low because:
  • JWKS endpoints are typically protected and signed
  • The library still validates supported key types properly
  • ID token verification remains intact via verifier.Verify()

This update is a security-sensitive change to the authentication layer that requires manual review of the upstream PR (#499) and potentially testing against your OIDC provider.

Recommendation

Needs manual review — This is a security-critical authentication library (OIDC + JWT validation). While the change appears benign (more robust JWKS handling), the special exclusion rule requires manual review for all go-oidc updates. Test against your OIDC provider before merging to ensure no behavioral regressions in token verification.

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: github.com/coreos/go-oidc/v3
• Version: v3.20.0 → v3.21.0
• Type: patch

Release Changes

• Main Change: "oidc: ignore JWKs with unsupported key types rather than failing" (PR #499 by @nicoske)
• Behavioral Change: Skip keys whose unmarshal fails with jose.ErrUnsupportedKeyType instead of failing the whole set, matching the existing "alg" skip behavior
• Impact: This affects JWK (JSON Web Key) set parsing and error handling during token verification

Breaking Changes

• No API breaking changes reported
• No deprecations announced
• Behavioral change in error handling (fail-fast vs graceful degradation)

Code Changes Required

• No code changes required - this is a dependency-only update
• Update is in go.mod and go.sum only

Security Impact

• High Impact Area: This is a security-critical authentication library used in internal/auth/oidc.go for OIDC authentication flows
• Change Implications: The behavioral change makes the library more lenient when encountering unsupported key types in JWK sets
• Positive: May prevent denial of service from malicious providers sending unsupported keys
• Concern: Reduced strictness in key validation could potentially allow certain attack vectors if unsupported keys are silently ignored
• Usage Context: Used for ID token verification (verifier.Verify()), JWK discovery, and OAuth2 flows in authentication

Recommendation

Needs manual review — Security-critical dependency with behavioral changes affecting JWT key validation. This library handles OIDC authentication and ID token verification. The change from "fail on unsupported key types" to "ignore unsupported key types" represents a significant behavioral change in security-critical path. While this may improve reliability, it requires manual review to ensure the security implications are acceptable for TinyRSVP's threat model and authentication requirements.

Special Exclusion: This dependency is in the special exclusions list per project guidelines (OIDC/go-jose - authentication and JWT handling) and must be manually reviewed.

[github-actions]

Renovate PR Analysis

Re-analysis after rebase: new commit 6aa71421 (2026-09-03) supersedes the analysis from 2026-09-02. Content of the bump is unchanged (v3.20.0 → v3.21.0).

Update Summary

• Dependency: github.com/coreos/go-oidc/v3
• Version: v3.20.0 → v3.21.0
• Type: minor

Release Changes

• Single change vs v3.20.0 (oidc: ignore JWKs with unsupported key types rather than failing coreos/go-oidc#499, merged 2026-09-01, +83/−0 across 2 files): "oidc: ignore JWKs with unsupported key types rather than failing"
• Behavioral change in JWKS resolution: when parsing a remote key set, keys whose jose.JSONWebKey.UnmarshalJSON fails with jose.ErrUnsupportedKeyType are now skipped instead of aborting the whole set — consistent with the pre-existing behavior for keys with unsupported alg values.
• No API changes, no deprecations, no dependency version bumps in this release (our go.sum diff confirms only the go-oidc entries change; go-jose/v4 v4.1.4 on main already satisfies the requirement).

Breaking Changes

None affecting our usage. Our surface (verified in internal/auth/oidc.go:64-119) is oidc.NewProvider, oidc.ClientContext, oidc.ScopeOpenID, provider.Verifier(&oidc.Config{ClientID: ...}), *oidc.IDTokenVerifier — all unchanged. No Go toolchain bump required (go.mod already declares go 1.26).

Code Changes Required

None. The diff touches go.mod/go.sum only.

Security Impact

• This is our OIDC authentication library (internal/auth/oidc.go) — the security-critical path for admin/manager ID-token verification against providers such as Authelia/Authentik.
• The change affects the remote JWKS fetch during verifier.Verify() key resolution: a provider returning a mixed key set containing an unsupported key type (e.g., OKP/EdDSA keys if unsupported by the installed go-jose) will now verify against the supported subset instead of erroring out.
• Hardening angle: prevents total auth outage caused by one exotic key in an IdP's JWKS (availability DoS fix).
• Strictness trade-off: unsupported keys are silently skipped rather than surfaced. Signature verification itself is not weakened — an attacker cannot get an unsupported key trusted; only tokens signed by supported keys can validate.
• Residual risk is provider-specific and low for standard homelab IdPs, but this changes fail-closed → fail-lenient behavior in token key resolution.

Recommendation

Needs manual review — github.com/coreos/go-oidc is on the project's special-exclusion list (authentication / JWT handling; same policy as go-jose and golang.org/x/oauth2), so this PR is never auto-merged. The change is small, non-breaking, and security-positive on balance, but it alters fail-closed behavior in ID-token key resolution, so it should be explicitly approved by a maintainer. Suggested validation after merge: run go test -timeout 30s ./internal/auth/... and one OIDC sign-in against the test stack (docker compose -f docker-compose.test.yml -f docker-compose.local.yml up -d authelia).